checks/lints.nu

@@ -1,10 +1,8 @@
 #!/usr/bin/env nu
 
-let shell_files = ls **/*.sh | get name
 let nix_files = ls **/*.nix | where name !~ "hardware-configuration.nix|_sources" | get name
 
 let linters = [
-  ([shellcheck] ++ $shell_files)
   ([nixfmt --check --strict] ++ $nix_files)
   ([deadnix --fail] ++ $nix_files)
   ([statix check] ++ $nix_files)

flake.nix

@@ -37,7 +37,6 @@
     }@inputs:
     let
       system = "x86_64-linux";
-      pkgs = nixpkgs.legacyPackages.${system};
 
       vm = nixpkgs.lib.nixosSystem {
         inherit system;
@@ -97,15 +96,10 @@
       # Garbage collection root #
       ###########################
 
-      packages.${system} =
+      packages.${system} = {
-        let
+        default = vm.config.system.build.vm;
-          localPkgs = import ./pkgs { inherit pkgs; };
+      }
-        in
+      // import ./pkgs { pkgs = nixpkgs.legacyPackages.${system}; };
-        {
-          default = vm.config.system.build.vm;
-          crowdsec-hub = localPkgs.crowdsec.hub;
-          crowdsec-firewall-bouncer = localPkgs.crowdsec.firewall-bouncer;
-        };
 
       ###################
       # Utility scripts #
@@ -116,26 +110,10 @@
         run-vm = {
           type = "app";
           program =
-            (pkgs.writeShellScript "" ''
+            (nixpkgs.legacyPackages.${system}.writeShellScript "" ''
               ${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
             '').outPath;
         };
-
-        update-crowdsec-packages =
-          let
-            git = pkgs.lib.getExe pkgs.git;
-            nvfetcher = pkgs.lib.getExe pkgs.nvfetcher;
-          in
-          {
-            type = "app";
-            program =
-              (pkgs.writeShellScript "update-crowdsec-packages" ''
-                cd "$(${git} rev-parse --show-toplevel)"
-                cd ./pkgs/crowdsec
-                ${nvfetcher}
-                echo 'Remember to update the vendorHash of any go packages!'
-              '').outPath;
-          };
       };
 
       ###########################
@@ -147,16 +125,16 @@
             "./keys/hosts/"
             "./keys/users/"
           ];
-          nativeBuildInputs = [ sops-nix.packages.${system}.sops-import-keys-hook ];
 
-          packages = with pkgs; [
+          packages = nixpkgs.lib.attrValues {
-            sops-nix.packages.${system}.sops-init-gpg-key
+            inherit (sops-nix.packages.${system}) sops-import-keys-hook sops-init-gpg-key;
-            deploy-rs.packages.${system}.default
+            inherit (deploy-rs.packages.${system}) default;
-            nixpkgs-fmt
+          };
-          ];
+        };
+
+        minecraft = nixpkgs.legacyPackages.${system}.mkShell {
+          packages = nixpkgs.lib.attrValues { inherit (nixpkgs.legacyPackages.${system}) packwiz; };
         };
       };
-
-      minecraft = nixpkgs.legacyPackages.${system}.mkShell { packages = [ pkgs.packwiz ]; };
     };
 }

pkgs/crowdsec/_sources/generated.json

@@ -1,44 +0,0 @@
-{
-    "crowdsec-firewall-bouncer": {
-        "cargoLocks": null,
-        "date": null,
-        "extract": null,
-        "name": "crowdsec-firewall-bouncer",
-        "passthru": null,
-        "pinned": false,
-        "src": {
-            "deepClone": false,
-            "fetchSubmodules": false,
-            "leaveDotGit": false,
-            "name": null,
-            "owner": "crowdsecurity",
-            "repo": "cs-firewall-bouncer",
-            "rev": "v0.0.34",
-            "sha256": "sha256-lDO9pwPkbI+FDTdXBv03c0p8wbkRUiIDNl1ip3AZo2g=",
-            "sparseCheckout": [],
-            "type": "github"
-        },
-        "version": "v0.0.34"
-    },
-    "crowdsec-hub": {
-        "cargoLocks": null,
-        "date": "2025-08-17",
-        "extract": null,
-        "name": "crowdsec-hub",
-        "passthru": null,
-        "pinned": false,
-        "src": {
-            "deepClone": false,
-            "fetchSubmodules": false,
-            "leaveDotGit": false,
-            "name": null,
-            "owner": "crowdsecurity",
-            "repo": "hub",
-            "rev": "fc59f78180f3edfce76df3e77b001c454f567d3d",
-            "sha256": "sha256-Ejx3ta05SMvV/Dj7wy2iF9QYbGoRvxPB3+QuCIoTX4Q=",
-            "sparseCheckout": [],
-            "type": "github"
-        },
-        "version": "fc59f78180f3edfce76df3e77b001c454f567d3d"
-    }
-}

pkgs/crowdsec/_sources/generated.nix

@@ -1,27 +0,0 @@
-# This file was generated by nvfetcher, please do not modify it manually.
-{ fetchgit, fetchurl, fetchFromGitHub, dockerTools }:
-{
-  crowdsec-firewall-bouncer = {
-    pname = "crowdsec-firewall-bouncer";
-    version = "v0.0.34";
-    src = fetchFromGitHub {
-      owner = "crowdsecurity";
-      repo = "cs-firewall-bouncer";
-      rev = "v0.0.34";
-      fetchSubmodules = false;
-      sha256 = "sha256-lDO9pwPkbI+FDTdXBv03c0p8wbkRUiIDNl1ip3AZo2g=";
-    };
-  };
-  crowdsec-hub = {
-    pname = "crowdsec-hub";
-    version = "fc59f78180f3edfce76df3e77b001c454f567d3d";
-    src = fetchFromGitHub {
-      owner = "crowdsecurity";
-      repo = "hub";
-      rev = "fc59f78180f3edfce76df3e77b001c454f567d3d";
-      fetchSubmodules = false;
-      sha256 = "sha256-Ejx3ta05SMvV/Dj7wy2iF9QYbGoRvxPB3+QuCIoTX4Q=";
-    };
-    date = "2025-08-17";
-  };
-}

pkgs/crowdsec/default.nix

@@ -1,9 +0,0 @@
-{ pkgs }:
-let
-  sources = pkgs.callPackage ./_sources/generated.nix { };
-  callPackage = pkgs.lib.callPackageWith (pkgs // { inherit sources; });
-in
-{
-  hub = callPackage ./hub.nix { };
-  firewall-bouncer = callPackage ./firewall-bouncer.nix { };
-}

pkgs/crowdsec/firewall-bouncer.nix

@@ -1,26 +0,0 @@
-{
-  lib,
-  sources,
-  buildGoModule,
-  envsubst,
-  coreutils,
-}:
-let
-  envsubstBin = lib.getExe envsubst;
-in
-buildGoModule {
-  inherit (sources.crowdsec-firewall-bouncer) pname version src;
-
-  vendorHash = "sha256-SbpclloBgd9vffC0lBduGRqPOqmzQ0J91/KeDHCh0jo=";
-
-  postInstall = ''
-    mkdir -p $out/lib/systemd/system
-
-    CFG=/var/lib/crowdsec/config BIN=$out/bin/cs-firewall-bouncer ${envsubstBin} \
-      -i ./config/crowdsec-firewall-bouncer.service \
-      -o $out/lib/systemd/system/crowdsec-firewall-bouncer.service
-
-    substituteInPlace $out/lib/systemd/system/crowdsec-firewall-bouncer.service \
-      --replace-fail /bin/sleep ${coreutils}/bin/sleep
-  '';
-}

pkgs/crowdsec/hub.nix

@@ -1 +0,0 @@
-{ sources }: sources.crowdsec-hub.src

pkgs/crowdsec/nvfetcher.toml

@@ -1,7 +0,0 @@
-[crowdsec-hub]
-src.git = "https://github.com/crowdsecurity/hub.git"
-fetch.github = "crowdsecurity/hub"
-
-[crowdsec-firewall-bouncer]
-src.github = "crowdsecurity/cs-firewall-bouncer"
-fetch.github = "crowdsecurity/cs-firewall-bouncer"

pkgs/default.nix

@@ -1,5 +1,5 @@
 { pkgs }:
-{
+pkgs.lib.packagesFromDirectoryRecursive {
-  crowdsec = import ./crowdsec { inherit pkgs; };
+  inherit (pkgs) callPackage;
-  starbound = pkgs.callPackage ./starbound { };
+  directory = ./packages;
 }

pkgs/packages/crowdsec-firewall-bouncer.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  envsubst,
+  coreutils,
+
+  writers,
+  nix-update,
+}:
+let
+  envsubstBin = lib.getExe envsubst;
+in
+buildGoModule (drv: {
+  pname = "crowdsec-firewall-bouncer";
+  version = drv.src.rev;
+
+  src = fetchFromGitHub {
+    owner = "crowdsecurity";
+    repo = "cs-firewall-bouncer";
+    rev = "0.0.34";
+    sha256 = "sha256-lDO9pwPkbI+FDTdXBv03c0p8wbkRUiIDNl1ip3AZo2g=";
+  };
+
+  vendorHash = "sha256-SbpclloBgd9vffC0lBduGRqPOqmzQ0J91/KeDHCh0jo=";
+
+  postInstall = ''
+    mkdir -p $out/lib/systemd/system
+
+    CFG=/var/lib/crowdsec/config BIN=$out/bin/cs-firewall-bouncer ${envsubstBin} \
+      -i ./config/crowdsec-firewall-bouncer.service \
+      -o $out/lib/systemd/system/crowdsec-firewall-bouncer.service
+
+    substituteInPlace $out/lib/systemd/system/crowdsec-firewall-bouncer.service \
+      --replace-fail /bin/sleep ${coreutils}/bin/sleep
+  '';
+
+  passthru.updateScript =
+    writers.writeNuBin "update-crowdsec-firewall-bouncer"
+      {
+        makeWrapperArgs = [
+          "--prefix"
+          "PATH"
+          ":"
+          (lib.makeBinPath [ nix-update ])
+        ];
+      }
+      ''
+        nix-update --flake --format crowdsec-firewall-bouncer
+      '';
+})

pkgs/packages/crowdsec-hub.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenvNoCC,
+
+  writers,
+  nix-update,
+}:
+# Using `mkDerivation` so nix-update can pick up the version
+stdenvNoCC.mkDerivation (drv: {
+  pname = "crowdsec-hub";
+  version = drv.src.rev;
+
+  src = fetchFromGitHub {
+    owner = "crowdsecurity";
+    repo = "hub";
+    rev = "fc59f78180f3edfce76df3e77b001c454f567d3d";
+    hash = "sha256-Ejx3ta05SMvV/Dj7wy2iF9QYbGoRvxPB3+QuCIoTX4Q=";
+  };
+
+  installPhase = ''
+    cp -r $src $out
+  '';
+
+  passthru.updateScript =
+    writers.writeNuBin "update-crowdsec-hub"
+      {
+        makeWrapperArgs = [
+          "--prefix"
+          "PATH"
+          ":"
+          (lib.makeBinPath [ nix-update ])
+        ];
+      }
+      ''
+        nix-update --flake --format --version=branch crowdsec-hub
+      '';
+})

pkgs/starbound/default.nix

@@ -1,37 +0,0 @@
-{
-  stdenv,
-  lib,
-  makeWrapper,
-  patchelf,
-  steamPackages,
-  replace-secret,
-}:
-let
-  # Use the directory in which starbound is installed so steamcmd
-  # doesn't have to be reinstalled constantly (we're using DynamicUser
-  # with StateDirectory to persist this).
-  steamcmd = steamPackages.steamcmd.override { steamRoot = "/var/lib/starbound/.steamcmd"; };
-  wrapperPath = lib.makeBinPath [
-    patchelf
-    steamcmd
-    replace-secret
-  ];
-in
-stdenv.mkDerivation {
-  name = "starbound-update-script";
-  nativeBuildInputs = [ makeWrapper ];
-  dontUnpack = true;
-  patchPhase = ''
-    interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
-    substitute ${./launch-starbound.sh} launch-starbound --subst-var interpreter
-  '';
-  installPhase = ''
-    mkdir -p $out/bin
-    cp launch-starbound $out/bin/launch-starbound
-    chmod +x $out/bin/launch-starbound
-  '';
-  postFixup = ''
-    wrapProgram $out/bin/launch-starbound \
-        --prefix PATH : "${wrapperPath}"
-  '';
-}

pkgs/starbound/launch-starbound.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu
-
-if ! [[ -v STATE_DIRECTORY  &&  -v CREDENTIALS_DIRECTORY ]]; then
-    echo "Error: Runtime dir or credential not set"
-    exit 1
-fi
-
-# Update the server to the latest version
-echo "Updating/installing starbound"
-
-mkdir -p "${STATE_DIRECTORY}/.steamcmd"
-steamcmd <<EOF
-force_install_dir $STATE_DIRECTORY
-login tlater $(cat "$CREDENTIALS_DIRECTORY/steam")
-app_update 211820
-quit
-EOF
-
-echo "Updating config"
-if [ -f "$1" ]; then
-    mkdir -p ./storage
-    cp "$1" ./storage/starbound_server.config
-fi
-
-echo "Running starbound server"
-patchelf --set-interpreter '@interpreter@' ./linux/starbound_server
-# Must be run from the directory that the binary is in (why do game
-# devs do this?)
-cd linux
-./starbound_server

pkgs/update.nu

@@ -0,0 +1,23 @@
+use std/log
+
+let packages_with_updatescript = (
+  nix flake show --json
+  | from json
+  | $in.packages.x86_64-linux
+  | columns
+  | filter {|p| nix eval $'.#($p)' --apply 'builtins.hasAttr "updateScript"' | $in == 'true' }
+)
+
+for $package in $packages_with_updatescript {
+  log info $'Updating ($package)'
+  nix run $'.#($package).updateScript'
+}
+
+log info 'Committing changes'
+
+try {
+  git add pkgs
+  git commit -m 'update(pkgs): Update sources of all downstream packages'
+} catch {
+  log warning 'No changes to commit'
+}